Graphical display of plot of bins over which items represented within log events having a power law-oriented distribution are organized

Abstract

For each item represented within log events that have a power law-oriented distribution, first and second metrics for the item are computed based on the log events which pertain to the item. The items are organized over bins according to the first metric. The bins correspond to different ranges of the first metric. For each bin, the items in the bin are ordered according to the second metric. A plot of the bins over which the items have been organized according to the first metric, is graphically displayed, which includes displaying, for each bin, the items in the bin as have been ordered according to the second metric.

We claim: 
     
         1 . A non-transitory computer-readable data storage medium storing program code executable by a processor to perform processing comprising:
 computing, for each item of a plurality of items represented within a plurality of log events having a power law-oriented distribution, first and second metrics for the item based on the log events pertaining to the item;   organizing the plurality of items over a plurality of bins according to the first metric, the bins corresponding to different ranges of the first metric respectively having representative values;   for each bin, ordering the plurality of items in the bin according to the second metric; and   graphically displaying a plot of the bins over which the plurality of items have been organized according to the first metric, including displaying, for each bin, the plurality of items in the bin as have been ordered according to the second metric,   wherein along an x-axis of the plot, the bins are plotted in order of the different ranges of the first metric to which the bins correspond, and the plurality of items in each bin are plotted in order of the second metric,   and wherein along a y-axis of the plot, the bins are plotted according to the representative values of the different ranges of the first metric to which the bins correspond, and the plurality of items in each bin are plotted according to values of the plurality of items for the second metric,   wherein in the graphically displayed plot, each item has a corresponding first point for the first metric and a corresponding second point for the second metric.   
     
     
         2 . The non-transitory computer-readable data storage medium of  claim 1 , wherein the plurality of items are devices, and the processing further comprises:
 identifying one of the plurality of items within the plot that has an anomaly; and   performing an action relative to the identified one of the plurality of items to resolve the anomaly.   
     
     
         3 . The non-transitory computer-readable data storage medium of  claim 1 , wherein the processing further comprises:
 receiving selection of one of the plurality of items within the plot; and   displaying information regarding the one of the plurality of items that has been selected.   
     
     
         4 . The non-transitory computer-readable data storage medium of  claim 1 , wherein the processing further comprises:
 receiving selection of one of the bins within the plot; and   expanding the one of the bins that has been selected within graphical display of the plot.   
     
     
         5 . The non-transitory computer-readable data storage medium of  claim 1 , wherein the processing further comprises:
 filtering the log events prior to graphically displaying the plot, such that the plurality of items denoted within the plot are a subset of all the plurality of items represented within the log events.   
     
     
         6 . The non-transitory computer-readable data storage medium of  claim 1 , wherein the corresponding representative values of each the different ranges are each a minimum value or a maximum value of the respective different range. 
     
     
         7 . The non-transitory computer-readable data storage medium of  claim 1 , wherein the x-axis is logarithmic. 
     
     
         8 . A system comprising:
 a processor; and   a memory storing program code executable by the processor to:
 receive a plurality of log events having a power law-oriented distribution, wherein a plurality of items are represented within the log events; 
 prior to receiving a plot request, compute a first metric for each item and aggregating each item based on ranges of the first metric; 
 in response to receiving the plot request, organize the items over a plurality of bins according to the first metric, the bins corresponding to different ranges of the first metric specified within the plot request, wherein the different ranges are larger than the ranges on which basis each item has been aggregated; 
 for each bin, order the items in the bin according to a second metric; and 
 graphically display a plot of the bins, including displaying, for each bin, the items in the bin as have been ordered according to the second metric, 
   wherein in the graphically displayed plot, each item has a corresponding first point for the first metric and a corresponding second point for the second metric,   wherein the bins are plotted along an x-axis of the plot in order of the different ranges of the first metric to which the bins correspond,   wherein the bins are plotted along an y-axis of the plot according to representative values of the different ranges of the first metric to which the bins correspond, where each different range has a corresponding representative value,   wherein, for each bin, the items in the bin are plotted along the x-axis of the plot in order of the second metric,   and wherein, for each bin, the items in the bin are plotted along the y-axis of the plot according to values of the items for the second metric.   
     
     
         9 . The system of  claim 8 , wherein the items are organized over the bins according to the first metric using prior aggregation of each item based on the ranges of the first metric. 
     
     
         10 . The system of  claim 8 , wherein the program code is executable by the processor to further:
 prior to receiving the plot request, compute the second metric for each item, such that the second metric does not have to be computed responsive to receiving the plot request.   
     
     
         11 . The system of  claim 8 , wherein the program code is executable by the processor to further:
 in response to receiving the plot request, for each item, compute the second metric that is specified in the plot request.   
     
     
         12 . A method comprising:
 receiving, by a processor, a plurality of log events having a power law-oriented distribution, wherein a plurality of items are represented within the log events;   prior to receiving a plot request, computing, by the processor, first and second metrics for each item;   in response to receiving the plot request, organizing, by the processor, the items over a plurality of bins according to the first metric, the bins corresponding to different ranges of the first metric;   for each bin, ordering, by the processor, the items in the bin according to the second metric; and   graphically displaying, by the processor, a plot of the bins, including displaying, for each bin, the items in the bin as have been ordered according to the second metric,   wherein in the graphically displayed plot, each item has a corresponding first point for the first metric and a corresponding second point for the second metric,   wherein the bins are plotted along an x-axis of the plot in order of the different ranges of the first metric to which the bins correspond,   wherein the bins are plotted along a y-axis of the plot according to representative values of the different ranges of the first metric to which the bins correspond, where each different range has a corresponding representative value,   wherein, for each bin, the items in the bin are plotted along the x-axis of the plot in order of the second metric,   and wherein, for each bin, the items in the bin are plotted along the y-axis of the plot according to values of the items for the second metric.   
     
     
         13 . The method of  claim 12 , wherein the items are organized over the bins according to the first metric using prior computation of the first metric for each item,
 and wherein, for each bin, the plurality of items are ordered in the bin according the second metric using prior computation of the second metric for each item.